API Authentication

Last updated October 26, 2026

Every request to the PDFMonkey API must include your secret API key. This page explains how to find your key, send it with requests, and verify that authentication works.

Find your API secret key #

Your API secret key is available on the dedicated API Key page in the PDFMonkey Dashboard, accessible directly from the sidebar.

Keep your key secret

Your API secret key carries the same privileges as your account. Do not share it publicly or commit it to version control. If you believe your key has been compromised, rotate it and revoke the previous key right away.

Send your key with requests #

Pass your key in the Authorization HTTP header, prefixed with Bearer:

Authorization: Bearer YOUR_SECRET_KEY

Make a test API call #

To verify that authentication works, call the current_user endpoint:

GET https://api.pdfmonkey.io/api/v1/current_user
Authorization: Bearer YOUR_SECRET_KEY

Using curl, the request looks like this:

curl https://api.pdfmonkey.io/api/v1/current_user \
  -H "Authorization: Bearer YOUR_SECRET_KEY"

A successful response returns your account information:

{
  "current_user": {
    "id": "12345678-90ab-cdef-1234-567890abcdef",
    "auth_token": "1234567890ABCDEF1234",
    "available_documents": 300,
    "created_at": "2022-01-01T12:34:56.123+00:00",
    "current_plan": "free",
    "current_plan_interval": "month",
    "desired_name": "Jane Doe",
    "email": "jane.doe@example.com",
    "lang": "en",
    "paying_customer": false,
    "trial_ends_on": "2022-01-15",
    "updated_at": "2022-01-01T12:34:56.123+00:00",
    "block_resources": true,
    "share_links": false
  }
}

Authentication errors #

If the key is missing or invalid, the API returns a 401 Unauthorized response:

{
  "errors": [
    {
      "status": "401",
      "title": "Unauthorized",
      "detail": "We were unable to authenticate you based on the provided API key. Please verify that you provided the intended key."
    }
  ]
}

Rotate your API key #

To replace your key, click Rotate API key on the API Key page. You get a new key right away, and your previous key keeps working for 2 days, so you can update your integrations without downtime.

Once everything uses the new key, click Revoke previous key now to disable the old one immediately. Otherwise, it expires on its own after 2 days. You can rotate again once the previous key has expired or been revoked.

If your key has been compromised, don’t wait: rotate it and revoke the previous key right away.

Next steps #

Now that you can authenticate, you are ready to:

Frequently asked questions

How do I authenticate with the PDFMonkey API?
Pass your secret API key in the Authorization HTTP header as a Bearer token. The format is: Authorization: Bearer YOUR_SECRET_KEY. Every request to the PDFMonkey API requires this header.
Where do I find my PDFMonkey API key?
Your API secret key is available on the API Key page in the PDFMonkey Dashboard, accessible directly from the sidebar.
What should I do if my PDFMonkey API key is compromised?
Rotate it from the API Key page in the Dashboard, then click Revoke previous key now so the old key stops working immediately. Without revocation, the previous key keeps working for 2 days.
How do I rotate my PDFMonkey API key without downtime?
Click Rotate API key on the API Key page in the Dashboard. You get a new key right away, and your previous key keeps working for 2 days so you can update your integrations.
Navigation